What it asks for. Taking into account the nature, scope, context and purposes of processing and the risks to individuals, the controller must implement appropriate technical and organisational measures to ensure, and be able to demonstrate, that processing complies with the regulation. Measures must be reviewed and updated where necessary and, where proportionate, include data protection policies. Adherence to approved codes of conduct or certifications can help demonstrate compliance.
In practice. Organisations treat this as the operational form of accountability: a governance structure with owners, policies, training, risk assessment and monitoring of compliance. Evidence includes approved policies, a privacy risk register, management reporting, internal audit results and records showing measures were reviewed after changes or incidents.
Common gaps. Policies often exist without monitoring to show they are followed. Reviews are also skipped, so measures fall behind changes in processing and risk.